[PATCH v3 3/6] sign-file: add support sign modules in bulk

From: Shreenidhi Shedi
Date: Mon Feb 13 2023 - 14:01:29 EST


In the existing system, we need to invoke sign-file binary for every
module we want to sign. This patch adds support to give modules in bulk
and it will sign them all one by one.

Signed-off-by: Shreenidhi Shedi <sshedi@xxxxxxxxxx>
---
scripts/sign-file.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/scripts/sign-file.c b/scripts/sign-file.c
index 4732201feb96..7ad330b47d64 100644
--- a/scripts/sign-file.c
+++ b/scripts/sign-file.c
@@ -224,6 +224,7 @@ struct cmd_opts {
bool replace_orig;
bool raw_sig;
bool sign_only;
+ bool bulk_sign;

#ifndef USE_PKCS7
unsigned int use_keyid;
@@ -237,6 +238,7 @@ static void parse_args(int argc, char **argv, struct cmd_opts *opts)
{"help", no_argument, 0, 'h'},
{"savesig", no_argument, 0, 's'},
{"signonly", no_argument, 0, 'o'},
+ {"bulksign", no_argument, 0, 'b'},
#ifndef USE_PKCS7
{"usekeyid", no_argument, 0, 'k'},
#endif
@@ -305,6 +307,10 @@ static void parse_args(int argc, char **argv, struct cmd_opts *opts)
opts->replace_orig = true;
break;

+ case 'b':
+ opts->bulk_sign = true;
+ break;
+
case -1:
break;

@@ -342,12 +348,13 @@ int sign_file(int argc, char **argv, struct cmd_opts *opts)
bool replace_orig = opts->replace_orig;
bool raw_sig = opts->raw_sig;
bool sign_only = opts->sign_only;
+ bool bulk_sign = opts->bulk_sign;

#ifndef USE_PKCS7
unsigned int use_keyid = opts->use_keyid;
#endif

- if (!argv[0] || argc != 1)
+ if ((bulk_sign && dest_name) || (!bulk_sign && argc != 1))
format();

if (dest_name && strcmp(argv[0], dest_name)) {
@@ -378,6 +385,16 @@ int sign_file(int argc, char **argv, struct cmd_opts *opts)
use_signed_attrs = PKCS7_NOATTR;
#endif

+ for (i = 0; i < argc; i++) {
+ module_name = argv[i];
+
+ if (bulk_sign) {
+ ERR(asprintf(&dest_name, "%s.~signed~", module_name) < 0,
+ "asprintf");
+ if (!replace_orig)
+ replace_orig = true;
+ }
+
/* Open the module file */
bm = BIO_new_file(module_name, "rb");
ERR(!bm, "%s", module_name);
@@ -486,6 +503,7 @@ int sign_file(int argc, char **argv, struct cmd_opts *opts)
/* Finally, if we're signing in place, replace the original. */
if (replace_orig)
ERR(rename(dest_name, module_name) < 0, "%s", dest_name);
+ }

return 0;
}
--
2.39.1